Each of these options has advantages and disadvantages, and also implications that aren't necessarily good or bad - they are just stuff you have to deal with. There is no option which is "best" in an absolute sense - options only have varying levels of suitability for a given problem.

Check to see if you have any guidance (e.g. architecture, internal standards or policies) that helps give direction.

If your architecture does not provide an answer on this then keep in mind that when you do make a decision you should record it as a pattern (noting when the pattern is applicable, when and why yo sue it, etc).

try and identify what "good" looks like, by drawing up a list of things that you think are important for any solution to be "good" (successful). Then score each option against that list. Things to consider when drawing up your list:

• (In no particular order): performance, security, maintainability, testability.

• Specific scenarios e.g. what happens if you want (or are forced to) to change the backend file storage technology? What happens if the API GW changes? What sorts of client will be requesting the files, and what happens if a new client type is needed?